No permission to view ticket unless permission set to FULL

skip · June 7, 2024, 8:43am

Used Zammad version: 6.3.1-1717069273.466794ba.jammy
Used Zammad installation type: package
Operating system: Ubuntu 22.04
Browser + version: Firefox 126.0.1 64bit

Expected behavior:

Be able to see tickets in all configured groups when permission is set to Change and Overview

Actual behavior:

Tickets of (a single group found so far) are not visible for the role the user is member of
To see the tickets of that group it is necessary to set the permission to full which is not what is intended

Steps to reproduce the behavior:

Import 50k+ tickets from OTRS
Have 339 groups
Set up manager role(s) to change and overview for 55 groups
Try to open ticket from queue with id 144
Get Oops.. I'm sorry, but you have insufficient rights to open this Ticket.

Role information from API

{
    "id": 506,
    "name": "[REDACTED]",
    "preferences": {},
    "default_at_signup": false,
    "active": true,
    "note": "",
    "updated_by_id": 85,
    "created_by_id": 1647,
    "created_at": "2024-06-05T13:42:21.398Z",
    "updated_at": "2024-06-07T08:25:56.444Z",
    "permission_ids": [
        48,
        50,
        56,
        57,
        60
    ],
    "knowledge_base_permission_ids": [],
    "group_ids": {
        "30": [
            "change",
            "overview"
        ],
        "36": [
            "change",
            "overview"
        ],
        "39": [
            "change",
            "overview"
        ],
        "40": [
            "change",
            "overview"
        ],
        "42": [
            "change",
            "overview"
        ],
        "45": [
            "change",
            "overview"
        ],
        "65": [
            "change",
            "overview"
        ],
        "66": [
            "change",
            "overview"
        ],
        "103": [
            "change",
            "overview"
        ],
        "121": [
            "change",
            "overview"
        ],
        "122": [
            "change",
            "overview"
        ],
        "123": [
            "change",
            "overview"
        ],
        "124": [
            "change",
            "overview"
        ],
        "125": [
            "change",
            "overview"
        ],
        "126": [
            "change",
            "overview"
        ],
        "127": [
            "change",
            "overview"
        ],
        "128": [
            "change",
            "overview"
        ],
        "129": [
            "change",
            "overview"
        ],
        "130": [
            "change",
            "overview"
        ],
        "131": [
            "change",
            "overview"
        ],
        "132": [
            "change",
            "overview"
        ],
        "133": [
            "change",
            "overview"
        ],
        "134": [
            "change",
            "overview"
        ],
        "135": [
            "change",
            "overview"
        ],
        "136": [
            "change",
            "overview"
        ],
        "137": [
            "change",
            "overview"
        ],
        "138": [
            "change",
            "overview"
        ],
        "139": [
            "change",
            "overview"
        ],
        "140": [
            "change",
            "overview"
        ],
        "141": [
            "change",
            "overview"
        ],
        "142": [
            "change",
            "overview"
        ],
        "143": [
            "change",
            "overview"
        ],
        "144": [
            "change",
            "overview"
        ],
        "145": [
            "change",
            "overview"
        ],
        "146": [
            "change",
            "overview"
        ],
        "147": [
            "change",
            "overview"
        ],
        "148": [
            "change",
            "overview"
        ],
        "149": [
            "change",
            "overview"
        ],
        "150": [
            "change",
            "overview"
        ],
        "151": [
            "change",
            "overview"
        ],
        "152": [
            "change",
            "overview"
        ],
        "153": [
            "change",
            "overview"
        ],
        "154": [
            "change",
            "overview"
        ],
        "155": [
            "change",
            "overview"
        ],
        "156": [
            "change",
            "overview"
        ],
        "157": [
            "change",
            "overview"
        ],
        "158": [
            "change",
            "overview"
        ],
        "159": [
            "change",
            "overview"
        ],
        "160": [
            "change",
            "overview"
        ],
        "173": [
            "change",
            "overview"
        ],
        "175": [
            "change",
            "overview"
        ],
        "176": [
            "change",
            "overview"
        ],
        "180": [
            "change",
            "overview"
        ],
        "182": [
            "change",
            "overview"
        ],
        "188": [
            "change",
            "overview"
        ]
    }
}

Zammad log

I, [2024-06-07T08:37:39.812660#10136-149720]  INFO -- : Started GET "/api/v1/ticket_overview?_=1717749447735" for [REDACTED] at 2024-06-07 08:37:39 +0000
I, [2024-06-07T08:37:39.821265#10136-149720]  INFO -- : Processing by TicketOverviewsController#data as JSON
I, [2024-06-07T08:37:39.821346#10136-149720]  INFO -- :   Parameters: {"_"=>"1717749447735"}
I, [2024-06-07T08:37:40.900773#10136-149720]  INFO -- : Completed 200 OK in 1079ms (Views: 107.2ms | ActiveRecord: 370.7ms | Allocations: 305238)
I, [2024-06-07T08:37:41.330071#1020-6786200]  INFO -- : execute Channel.fetch (try_count 0)...
I, [2024-06-07T08:37:41.332572#1020-6786200]  INFO -- : fetching pop3 (pop.imitate.email/NbSJAxVFWkCEhwGP454fMw port=995,ssl=true)
I, [2024-06-07T08:37:41.516236#1020-6786200]  INFO -- :  - no message
I, [2024-06-07T08:37:41.516325#1020-6786200]  INFO -- : done
I, [2024-06-07T08:37:41.527037#1020-6786200]  INFO -- : ended Channel.fetch took: 0.202658546 seconds.
I, [2024-06-07T08:37:45.994470#10136-149780]  INFO -- : Started POST "/api/v1/taskbar" for [REDACTED] at 2024-06-07 08:37:45 +0000
I, [2024-06-07T08:37:45.999331#10084-149720]  INFO -- : Started GET "/api/v1/tickets/49878?all=true&auto_assign=true&_=1717749447736" for [REDACTED] at 2024-06-07 08:37:45 +0000
I, [2024-06-07T08:37:46.002702#10136-149780]  INFO -- : Processing by TaskbarController#create as JSON
I, [2024-06-07T08:37:46.002927#10136-149780]  INFO -- :   Parameters: {"key"=>"Ticket-49878", "callback"=>"TicketZoom", "params"=>{"ticket_id"=>49878, "overview_id"=>25, "shown"=>true}, "prio"=>3, "notify"=>false, "active"=>true, "id"=>"c-1"}
I, [2024-06-07T08:37:46.009787#10084-149720]  INFO -- : Processing by TicketsController#show as JSON
I, [2024-06-07T08:37:46.009889#10084-149720]  INFO -- :   Parameters: {"all"=>"true", "auto_assign"=>"true", "_"=>"1717749447736", "id"=>"49878"}
I, [2024-06-07T08:37:46.039047#10136-149780]  INFO -- : Completed 201 Created in 36ms (Views: 0.7ms | ActiveRecord: 8.0ms | Allocations: 6822)
I, [2024-06-07T08:37:46.046745#10084-149720]  INFO -- : not allowed to show? this Ticket (Pundit::NotAuthorizedError)
app/controllers/application_controller/authorizes.rb:10:in `authorize!'
app/controllers/tickets_controller.rb:51:in `show'
app/controllers/application_controller/has_download.rb:17:in `block (4 levels) in <module:HasDownload>'
app/controllers/application_controller/has_download.rb:16:in `block (3 levels) in <module:HasDownload>'
app/controllers/application_controller/has_download.rb:15:in `block (2 levels) in <module:HasDownload>'
app/controllers/application_controller/handles_transitions.rb:16:in `handle_transaction'
I, [2024-06-07T08:37:46.047599#10084-149720]  INFO -- : Not authorized (Exceptions::Forbidden)

I, [2024-06-07T08:37:46.048589#10084-149720]  INFO -- : Completed 403 Forbidden in 39ms (Views: 0.6ms | ActiveRecord: 13.2ms | Allocations: 7356)

Ticket details:
id 49878

[3] pry(main)> Ticket.find_by(id: 49878)
=> #<Ticket:0x00007d08705fdc00
 id: 49878,
 group_id: 144,
 priority_id: 3,
 state_id: 4, # STATE 4 = OPEN
 organization_id: 992,
 number: "2023091310000246",
 title: "[REDACTED]",
 owner_id: 1,
 customer_id: 784,
 note: nil,
 first_response_at: Wed, 13 Sep 2023 15:35:09.000000000 UTC +00:00,
 first_response_escalation_at: nil,
 first_response_in_min: nil,
 first_response_diff_in_min: nil,
 close_at: Mon, 18 Sep 2023 11:28:08.000000000 UTC +00:00,
 close_escalation_at: nil,
 close_in_min: nil,
 close_diff_in_min: nil,
 update_escalation_at: nil,
 update_in_min: nil,
 update_diff_in_min: nil,
 last_close_at: Fri, 31 May 2024 12:31:31.434000000 UTC +00:00,
 last_contact_at: Thu, 06 Jun 2024 08:10:11.603000000 UTC +00:00,
 last_contact_agent_at: Fri, 15 Sep 2023 10:40:28.000000000 UTC +00:00,
 last_contact_customer_at: Thu, 06 Jun 2024 08:10:11.603000000 UTC +00:00,
 last_owner_update_at: nil,
 create_article_type_id: nil,
 create_article_sender_id: nil,
 article_count: 9,
 escalation_at: nil,
 pending_time: nil,
 type: nil,
 time_unit: nil,
 preferences:
  {"escalation_calculation"=>
    {"first_response_at"=>Wed, 13 Sep 2023 15:35:09.000000000 UTC +00:00,
     "last_update_at"=>Thu, 06 Jun 2024 08:10:11.603000000 UTC +00:00,
     "close_at"=>Mon, 18 Sep 2023 11:28:08.000000000 UTC +00:00,
     "last_contact_at"=>Thu, 06 Jun 2024 08:10:11.603000000 UTC +00:00,
     "sla_id"=>1,
     "sla_updated_at"=>Wed, 05 Jun 2024 15:29:42.404000000 UTC +00:00,
     "calendar_id"=>1,
     "calendar_updated_at"=>Thu, 06 Jun 2024 13:34:19.709000000 UTC +00:00,
     "escalation_disabled"=>false}},
 updated_by_id: 784,
 created_by_id: 784,
 created_at: Wed, 13 Sep 2023 15:29:21.000000000 UTC +00:00,
 updated_at: Thu, 06 Jun 2024 20:57:15.713000000 UTC +00:00,
 ticket_free_text1: nil,
 ticket_free_key2: nil,
 ticket_free_text2: nil,
 ticket_free_key3: nil,
 ticket_free_text3: nil,
 ticket_free_key4: nil,
 ticket_free_text4: nil>

Compared to a working ticket like e.g. 52374

[4] pry(main)> Ticket.find_by(id: 52374)
=> #<Ticket:0x00007d08705f3840                                                                                                    id: 52374,
 group_id: 147,
 priority_id: 3,
 state_id: 1, # STATE 1 = NEW
 organization_id: 387,
 number: "2024042410000171",
 title: "[REDACTED]",
 owner_id: 1,
 customer_id: 314,
 note: nil,
 first_response_at: nil,
 first_response_escalation_at: nil,
 first_response_in_min: nil,
 first_response_diff_in_min: nil,
 close_at: nil,
 close_escalation_at: nil,
 close_in_min: nil,
 close_diff_in_min: nil,
 update_escalation_at: nil,
 update_in_min: nil,
 update_diff_in_min: nil,
 last_close_at: nil,
 last_contact_at: nil,
 last_contact_agent_at: nil,
 last_contact_customer_at: nil,
 last_owner_update_at: nil,
 create_article_type_id: 10,
 create_article_sender_id: 2,
 article_count: 1,
 escalation_at: nil,
 pending_time: nil,
 type: nil,
 time_unit: nil,
 preferences:
  {"escalation_calculation"=>
    {"sla_id"=>1,
     "sla_updated_at"=>Wed, 05 Jun 2024 15:29:42.404000000 UTC +00:00,
     "calendar_id"=>1,
     "calendar_updated_at"=>Wed, 05 Jun 2024 13:34:10.274000000 UTC +00:00,
     "escalation_disabled"=>false}},
 updated_by_id: 1,
 created_by_id: 314,
 created_at: Wed, 24 Apr 2024 17:00:44.000000000 UTC +00:00,
 updated_at: Wed, 05 Jun 2024 15:29:45.245000000 UTC +00:00,
 ticket_free_text1: nil,
 ticket_free_key2: nil,
 ticket_free_text2: nil,
 ticket_free_key3: nil,
 ticket_free_text3: nil,
 ticket_free_key4: nil,
 ticket_free_text4: nil>

Thanks for any ideas or tips

fliebe92 · June 13, 2024, 6:59am

Hi @skip. In my understanding, read permission is missing.

skip · June 13, 2024, 7:05am

Hi @fliebe92

That is correct, read is missing.

I am not sure how the permission system in Zammad works, I suppose that if the role has Change it can automatically Read, since that for changing content you need to be able to read it too.

Although the tickets of the other 54 groups where the role only has Change and Overview permissions can be read without issues, just that one with id 144 cannot be read.

Thank you again for your time

skip · June 13, 2024, 7:12am

Alright,

I did some testing.
The even with Change the Read permission is required to be able to see tickets.

Thank you again for your support, time and for pointing me in the right direction!

system · June 20, 2024, 7:13am

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.